Temporal v1.31.4, published on October 12, 2026, tightens internal callback namespace validation, including a check of both token readings. For operators running data pipelines on Temporal, that is the main change to examine alongside conditional fair task cleanup and dependency updates addressing CVEs. This is a stable release, with the GitHub prerelease flag set to false.
The full release notes and downloads are on the GitHub release page.
Internal callbacks get two namespace changes ¶
Two entries concern namespace handling for internal callbacks. PR #12319 configures CHASM internal callback namespace binding. PR #12382 validates both token readings in the internal callback namespace check. Together, these are the most concrete validation changes described in the announcement.
The distinction matters when reviewing the patch. Configuring a namespace binding and checking both token readings are separate changes. A rollout review that records only a generic callback fix loses that detail. For deployments using these internal callback paths, namespace handling is therefore a specific area to include in regression coverage.
The notes do not describe the previous failure mode, the token format, or the conditions needed to encounter a problem. They also do not identify these callback changes as CVE fixes. Keep the callback review separate from the dependency security update below. There is no basis here for claiming that this patch resolves a particular cross namespace exploit.
Fair task cleanup becomes conditional on rangeid ¶
PR #12415 makes fair task garbage collection conditional on rangeid. The operational detail is the added condition on cleanup. The announcement gives no benchmark, storage reduction figure, or task throughput result.
For a data engineering platform, this points the rollout review toward task cleanup behavior. Where fair task processing is in use, include cleanup in validation instead of checking only whether new work starts successfully. That is an operational inference from the changed condition, rather than a documented test procedure supplied with the release.
The release notes do not explain the meaning of the condition or name a failure symptom. They therefore cannot establish whether an existing backlog, storage growth incident, or scheduling delay has the same cause. Treat rangeid as the concrete detail to investigate when comparing this patch with a production incident.
Dependency updates address CVEs ¶
PR #12499 bumps dependencies to address CVEs for v1.31.4. That gives platform operators a security maintenance reason to review the release even if the callback and fair task paths are outside their immediate workload.
The announcement does not list CVE identifiers, affected packages, severity scores, or replacement dependency versions. It supports saying that dependencies were updated for CVEs. It does not support assigning an urgency level or claiming that every finding in a deployment’s vulnerability report is resolved.
For release acceptance, compare the actual v1.31.4 artifact with the findings attached to the currently deployed artifact. The short dependency entry alone is insufficient evidence to close a specific vulnerability ticket.
The default CLI moves to 1.9.1 ¶
PR #12275 bumps the default CLI to 1.9.1 on release/v1.31.x. This is relevant to operator tooling wherever that default is used. Environments that pin a CLI separately need to distinguish their installed version from the release default.
No CLI flags, command changes, or output format changes are described in these notes. Record the version change when checking automation that invokes the default CLI, but do not infer a new command contract from the version bump alone. The announcement supplies no migration procedure or declared breaking change.